diff --git a/ansible/roles/caddy-ha/tasks/main.yml b/ansible/roles/caddy-ha/tasks/main.yml
index ce433370..f84e65de 100644
--- a/ansible/roles/caddy-ha/tasks/main.yml
+++ b/ansible/roles/caddy-ha/tasks/main.yml
@@ -64,11 +64,78 @@
group: root
notify: Reload Caddy
register: caddy_download
+ ignore_errors: true
+- name: Build Caddy with xcaddy (Fallback)
+ when: caddy_download is failed
+ block:
+ - name: Install Build Dependencies (git, curl)
+ apt:
+ pkg:
+ - curl
+ - git
+ - tar
+ state: present
+ update_cache: yes
+
+ - name: Download Go
+ get_url:
+ url: "https://go.dev/dl/go1.22.4.linux-amd64.tar.gz"
+ dest: "/tmp/go1.22.4.linux-amd64.tar.gz"
+
+ - name: Remove existing Go installation
+ file:
+ path: /usr/local/go
+ state: absent
+
+ - name: Extract Go
+ unarchive:
+ src: "/tmp/go1.22.4.linux-amd64.tar.gz"
+ dest: "/usr/local"
+ remote_src: yes
+
+ - name: Link Go binary
+ file:
+ src: /usr/local/go/bin/go
+ dest: /usr/bin/go
+ state: link
+ force: yes
+
+ - name: Install xcaddy (Add GPG key)
+ get_url:
+ url: https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key
+ dest: /usr/share/keyrings/caddy-xcaddy-archive-keyring.asc
+ mode: '0644'
+
+ - name: De-armor GPG key
+ shell: cat /usr/share/keyrings/caddy-xcaddy-archive-keyring.asc | gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
+ args:
+ creates: /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
+
+ - name: Install xcaddy (Add Repository)
+ copy:
+ content: "deb [signed-by=/usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/xcaddy/deb/debian any-version main"
+ dest: /etc/apt/sources.list.d/caddy-xcaddy.list
+
+ - name: Install xcaddy
+ apt:
+ name: xcaddy
+ state: present
+ update_cache: yes
+
+ - name: Build Caddy
+ command:
+ cmd: xcaddy build {{ caddy_version }} --output /usr/bin/caddy --with github.com/caddy-dns/cloudflare --with github.com/ss098/certmagic-s3
+ environment:
+ GOCACHE: "/tmp/.gocache"
+ PATH: "/usr/local/go/bin:{{ ansible_env.PATH }}"
+ register: xcaddy_build
+ notify: Reload Caddy
+
# Compatibility: Allow binding to 80/443 without root
- name: Set capabilities for Caddy
command: setcap cap_net_bind_service=+ep /usr/bin/caddy
- when: caddy_download.changed
+ when: caddy_download.changed or (xcaddy_build is defined and xcaddy_build.changed)
- name: Create Caddy config directory
file:
diff --git a/opentofu/.terraform.lock.hcl b/opentofu/.terraform.lock.hcl
index e88fdcab..0ce1f1e6 100644
--- a/opentofu/.terraform.lock.hcl
+++ b/opentofu/.terraform.lock.hcl
@@ -1,29 +1,6 @@
# This file is maintained automatically by "tofu init".
# Manual edits may be lost in future updates.
-provider "registry.opentofu.org/cloudflare/cloudflare" {
- version = "4.52.5"
- constraints = "~> 4.0"
- hashes = [
- "h1:18bXaaOSq8MWKuMxo/4y7EB7/i7G90y5QsKHZRmkoDo=",
- "zh:1a3400cb38863b2585968d1876706bcfc67a148e1318a1d325c6c7704adc999b",
- "zh:4c5062cb9e9da1676f06ae92b8370186d98976cc4c7030d3cd76df12af54282a",
- "zh:52110f493b5f0587ef77a1cfd1a67001fd4c617b14c6502d732ab47352bdc2f7",
- "zh:5aa536f9eaeb43823aaf2aa80e7d39b25ef2b383405ed034aa16a28b446a9238",
- "zh:5cc39459a1c6be8a918f17054e4fbba573825ed5597dcada588fe99614d98a5b",
- "zh:629ae6a7ba298815131da826474d199312d21cec53a4d5ded4fa56a692e6f072",
- "zh:719cc7c75dc1d3eb30c22ff5102a017996d9788b948078c7e1c5b3446aeca661",
- "zh:8698635a3ca04383c1e93b21d6963346bdae54d27177a48e4b1435b7f731731c",
- "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
- "zh:8a9993f1dcadf1dd6ca43b23348abe374605d29945a2fafc07fb3457644e6a54",
- "zh:b1b9a1e6bcc24d5863a664a411d2dc906373ae7a2399d2d65548ce7377057852",
- "zh:b270184cdeec277218e84b94cb136fead753da717f9b9dc378e51907f3f00bb0",
- "zh:dff2bc10071210181726ce270f954995fe42c696e61e2e8f874021fed02521e5",
- "zh:e8e87b40b6a87dc097b0fdc20d3f725cec0d82abc9cc3755c1f89f8f6e8b0036",
- "zh:ee964a6573d399a5dd22ce328fb38ca1207797a02248f14b2e4913ee390e7803",
- ]
-}
-
provider "registry.opentofu.org/hashicorp/aws" {
version = "5.100.0"
constraints = "~> 5.0"
diff --git a/opentofu/ingress.tf b/opentofu/ingress.tf
index 05d0bf71..22dbb9ea 100644
--- a/opentofu/ingress.tf
+++ b/opentofu/ingress.tf
@@ -1,75 +1,68 @@
moved {
- from = proxmox_lxc.lxc["232"]
- to = proxmox_lxc.caddy_srv_renner_uno
+ from = proxmox_lxc.caddy_srv_renner_uno
+ to = module.caddy_srv_renner_uno.proxmox_lxc.this
}
-resource "proxmox_lxc" "caddy_srv_renner_uno" {
+module "caddy_srv_renner_uno" {
+ source = "./modules/proxmox_lxc"
+
target_node = "neptune"
- hostname = "caddy.srv.renner.uno"
+ hostname = "caddy.dmz.renner.uno"
vmid = 232
- memory = 1024
- cores = 1
- arch = "amd64"
- ostype = "debian"
+ memory = 1024
+ cores = 1
+
unprivileged = true
- cmode = "tty"
- cpuunits = 1024
- tags = "caddy_ha"
- console = true
- tty = 2
+ cpuunits = 1024
+ tags = "caddy_ha"
+
+ hagroup = "olymp"
+ hastate = "started"
- hastate = "started"
- hagroup = "olymp"
+ storage = "local"
+ disk_size = "8G"
+ network_bridge = "v42ing"
+ ip_address = "10.2.45.101"
- rootfs {
- storage = "local"
- size = "8G"
- }
+ ssh_public_keys = local.common_ssh_keys
- lifecycle {
- ignore_changes = [
- rootfs[0].storage,
- target_node
- ]
- }
+ start = true
+ onboot = true
}
moved {
- from = proxmox_lxc.lxc["233"]
- to = proxmox_lxc.caddy2_srv_renner_uno
+ from = proxmox_lxc.caddy2_srv_renner_uno
+ to = module.caddy2_srv_renner_uno.proxmox_lxc.this
}
-resource "proxmox_lxc" "caddy2_srv_renner_uno" {
+module "caddy2_srv_renner_uno" {
+ source = "./modules/proxmox_lxc"
+
target_node = "saturn"
- hostname = "caddy2.srv.renner.uno"
+ hostname = "caddy2.dmz.renner.uno"
vmid = 233
- memory = 1024
- cores = 1
- arch = "amd64"
- ostype = "debian"
+ memory = 1024
+ cores = 1
+
unprivileged = true
- cmode = "tty"
- cpuunits = 1024
- tags = "caddy_ha"
- console = true
- tty = 2
+ cpuunits = 1024
+ tags = "caddy_ha"
+
+ hagroup = "olymp"
+ hastate = "started"
- hastate = "started"
- hagroup = "olymp"
+ storage = "local-zfs"
+ disk_size = "8G"
+ network_bridge = "v42ing"
+ ip_address = "10.2.45.103"
+
+ ssh_public_keys = local.common_ssh_keys
- rootfs {
- storage = "local-zfs"
- size = "8G"
- }
-
- lifecycle {
- ignore_changes = [
- rootfs[0].storage,
- target_node
- ]
- }
+ start = true
+ onboot = true
}
+
resource "aws_s3_bucket" "caddy_certificates" {
bucket = "caddy-certificates"
}
diff --git a/opentofu/lxc_114_gitea_srv_renner_uno.tf b/opentofu/lxc_114_gitea_srv_renner_uno.tf
index 977ede89..0439fb81 100644
--- a/opentofu/lxc_114_gitea_srv_renner_uno.tf
+++ b/opentofu/lxc_114_gitea_srv_renner_uno.tf
@@ -3,33 +3,32 @@ moved {
to = proxmox_lxc.gitea_srv_renner_uno
}
-resource "proxmox_lxc" "gitea_srv_renner_uno" {
+module "gitea_srv_renner_uno" {
+ source = "./modules/proxmox_lxc"
+
target_node = "jupiter"
hostname = "gitea.srv.renner.uno"
vmid = 114
- memory = 2048
- cores = 2
- arch = "amd64"
- ostype = "debian"
- cmode = "tty"
- cpuunits = 1024
- tags = "community-script;git"
- console = true
- tty = 2
+ memory = 2048
+ cores = 2
+
+ cpuunits = 1024
+ tags = "community-script;git"
+
+ hagroup = "olymp"
+ hastate = "started"
- hagroup = "olymp"
- hastate = "started"
+ unprivileged = false
+ onboot = false
+ start = false
- rootfs {
- storage = "local"
- size = "4G"
- }
+ storage = "local"
+ disk_size = "4G"
+}
- lifecycle {
- ignore_changes = [
- rootfs[0].storage
- ]
- }
+moved {
+ from = proxmox_lxc.gitea_srv_renner_uno
+ to = module.gitea_srv_renner_uno.proxmox_lxc.this
}
resource "unifi_dns_record" "gitea" {
diff --git a/opentofu/lxc_117_cloudflared_lxc.tf b/opentofu/lxc_117_cloudflared_lxc.tf
index 7a013440..0e5de6bd 100644
--- a/opentofu/lxc_117_cloudflared_lxc.tf
+++ b/opentofu/lxc_117_cloudflared_lxc.tf
@@ -3,31 +3,30 @@ moved {
to = proxmox_lxc.cloudflared_lxc
}
-resource "proxmox_lxc" "cloudflared_lxc" {
- target_node = "jupiter"
+module "cloudflared_lxc" {
+ source = "./modules/proxmox_lxc"
+
+ target_node = "saturn"
hostname = "cloudflared-lxc"
vmid = 117
- memory = 1024
- cores = 1
- arch = "amd64"
- ostype = "debian"
- cmode = "tty"
- cpuunits = 1024
- console = true
- tty = 2
+ memory = 1024
+ cores = 1
+
+ unprivileged = false
+ cpuunits = 1024
+
+ hagroup = "olymp"
+ hastate = "started"
- hastate = "started"
- hagroup = "olymp"
+ storage = "local"
+ disk_size = "4G"
+ network_bridge = "v42ing"
- rootfs {
- storage = "local"
- size = "4G"
- }
+ start = false
+ onboot = false
+}
- lifecycle {
- ignore_changes = [
- rootfs[0].storage,
- target_node,
- ]
- }
+moved {
+ from = proxmox_lxc.cloudflared_lxc
+ to = module.cloudflared_lxc.proxmox_lxc.this
}
diff --git a/opentofu/lxc_212_audiobookshelf.tf b/opentofu/lxc_212_audiobookshelf.tf
index 3fbb14e2..c7a1a3f5 100644
--- a/opentofu/lxc_212_audiobookshelf.tf
+++ b/opentofu/lxc_212_audiobookshelf.tf
@@ -3,16 +3,28 @@ moved {
to = proxmox_lxc.audiobookshelf
}
-resource "proxmox_lxc" "audiobookshelf" {
+module "audiobookshelf" {
+ source = "./modules/proxmox_lxc"
+
target_node = "jupiter"
hostname = "audiobookshelf"
vmid = 212
- memory = 2048
- cores = 2
- arch = "amd64"
- ostype = "debian"
- onboot = true
- cpuunits = 1024
+ memory = 2048
+ cores = 2
+
+ onboot = true
+ cpuunits = 1024
+ tags = "audiobook;community-script;podcast"
+
+ hagroup = "olymp"
+ hastate = "started"
+
+ unprivileged = false
+ start = false
+
+ storage = "cpool"
+ disk_size = "5G"
+
description = <<-EOT
EOT
- tags = "audiobook;community-script;podcast"
- console = true
- tty = 2
+}
- hastate = "started"
- hagroup = "olymp"
-
- rootfs {
- storage = "cpool"
- size = "5G"
- }
-
- lifecycle {
- ignore_changes = [
- rootfs[0].storage,
- description
- ]
- }
+moved {
+ from = proxmox_lxc.audiobookshelf
+ to = module.audiobookshelf.proxmox_lxc.this
}
diff --git a/opentofu/lxc_222_wazuh.tf b/opentofu/lxc_222_wazuh.tf
index 18e09f17..a05cc7ab 100644
--- a/opentofu/lxc_222_wazuh.tf
+++ b/opentofu/lxc_222_wazuh.tf
@@ -3,27 +3,27 @@ moved {
to = proxmox_lxc.wazuh
}
-resource "proxmox_lxc" "wazuh" {
+module "wazuh" {
+ source = "./modules/proxmox_lxc"
+
target_node = "neptune"
hostname = "wazuh"
vmid = 222
- memory = 4096
- cores = 4
- arch = "amd64"
- ostype = "debian"
- cmode = "tty"
- cpuunits = 1024
- tags = "community-script;monitoring;security"
- console = true
- tty = 2
- rootfs {
- storage = "local"
- size = "4G"
- }
+ memory = 4096
+ cores = 4
+
+ unprivileged = false
+ cpuunits = 1024
+ tags = "community-script;monitoring;security"
- lifecycle {
- ignore_changes = [
- rootfs[0].storage
- ]
- }
+ storage = "local"
+ disk_size = "4G"
+
+ start = false
+ onboot = false
+}
+
+moved {
+ from = proxmox_lxc.wazuh
+ to = module.wazuh.proxmox_lxc.this
}
diff --git a/opentofu/lxc_223_ollama.tf b/opentofu/lxc_223_ollama.tf
index 725440a7..4a4b66ea 100644
--- a/opentofu/lxc_223_ollama.tf
+++ b/opentofu/lxc_223_ollama.tf
@@ -3,17 +3,26 @@ moved {
to = proxmox_lxc.ollama
}
-resource "proxmox_lxc" "ollama" {
+module "ollama" {
+ source = "./modules/proxmox_lxc"
+
target_node = "jupiter"
hostname = "ollama"
vmid = 223
- memory = 32768
- cores = 20
- arch = "amd64"
- ostype = "ubuntu"
+ memory = 32768
+ cores = 20
+ ostype = "ubuntu"
+ ostemplate = "local:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst"
+
unprivileged = true
- onboot = true
- cpuunits = 1024
+ onboot = true
+ start = false
+ cpuunits = 1024
+ tags = "ai;community-script"
+
+ storage = "cpool"
+ disk_size = "120G"
+
description = <<-EOT
EOT
- tags = "ai;community-script"
- console = true
- tty = 2
- rootfs {
- storage = "cpool"
- size = "120G"
- }
+}
- lifecycle {
- ignore_changes = [
- rootfs[0].storage,
- description
- ]
- }
+moved {
+ from = proxmox_lxc.ollama
+ to = module.ollama.proxmox_lxc.this
}
diff --git a/opentofu/lxc_225_immich_srv_renner_uno.tf b/opentofu/lxc_225_immich_srv_renner_uno.tf
index 6eca5d17..8067da8e 100644
--- a/opentofu/lxc_225_immich_srv_renner_uno.tf
+++ b/opentofu/lxc_225_immich_srv_renner_uno.tf
@@ -3,32 +3,30 @@ moved {
to = proxmox_lxc.immich_srv_renner_uno
}
-resource "proxmox_lxc" "immich_srv_renner_uno" {
+module "immich_srv_renner_uno" {
+ source = "./modules/proxmox_lxc"
+
target_node = "jupiter"
hostname = "immich.srv.renner.uno"
vmid = 225
- memory = 8192
- cores = 8
- arch = "amd64"
- ostype = "debian"
+ memory = 8192
+ cores = 8
+
unprivileged = true
- cmode = "tty"
- cpuunits = 1024
- tags = "docker;immich;media"
- console = true
- tty = 2
- rootfs {
- storage = "local"
- size = "32G"
- }
+ cpuunits = 1024
+ tags = "docker;immich;media"
+
+ hagroup = "olymp"
+ hastate = "started"
- hagroup = "olymp"
- hastate = "started"
+ storage = "local"
+ disk_size = "32G"
- lifecycle {
- ignore_changes = [
- rootfs[0].storage,
- target_node,
- ]
- }
+ start = false
+ onboot = false
+}
+
+moved {
+ from = proxmox_lxc.immich_srv_renner_uno
+ to = module.immich_srv_renner_uno.proxmox_lxc.this
}
diff --git a/opentofu/modules/proxmox_lxc/main.tf b/opentofu/modules/proxmox_lxc/main.tf
index 17e30050..b5cdb7b1 100644
--- a/opentofu/modules/proxmox_lxc/main.tf
+++ b/opentofu/modules/proxmox_lxc/main.tf
@@ -16,13 +16,18 @@ resource "proxmox_lxc" "this" {
memory = var.memory
cores = var.cores
arch = "amd64"
- ostype = "debian"
+ ostype = var.ostype
ostemplate = var.ostemplate
unprivileged = var.unprivileged
cmode = "tty"
console = true
tty = 2
+ cpuunits = var.cpuunits
+ description = var.description
+ hastate = var.hastate
+ hagroup = var.hagroup
+
onboot = var.onboot
start = var.start
ssh_public_keys = var.ssh_public_keys
@@ -33,10 +38,13 @@ resource "proxmox_lxc" "this" {
nesting = true
}
- network {
- name = "eth0"
- bridge = var.network_bridge
- ip = "dhcp"
+ dynamic "network" {
+ for_each = var.network_bridge != null ? [1] : []
+ content {
+ name = "eth0"
+ bridge = var.network_bridge
+ ip = "dhcp"
+ }
}
rootfs {
@@ -48,6 +56,9 @@ resource "proxmox_lxc" "this" {
ignore_changes = [
rootfs[0].storage,
target_node,
+ description,
+ ostemplate,
+ features,
]
}
}
@@ -55,9 +66,11 @@ resource "proxmox_lxc" "this" {
resource "unifi_client" "this" {
count = var.ip_address != null ? 1 : 0
- mac = proxmox_lxc.this.network[0].hwaddr
+ mac = lower(proxmox_lxc.this.network[0].hwaddr)
name = var.hostname
+ local_dns_record = var.hostname
fixed_ip = var.ip_address
+ allow_existing = true
note = "Managed by Tofu (Module proxmox_lxc)"
lifecycle {
@@ -70,5 +83,5 @@ output "id" {
}
output "mac_address" {
- value = proxmox_lxc.this.network[0].hwaddr
+ value = try(proxmox_lxc.this.network[0].hwaddr, null)
}
diff --git a/opentofu/modules/proxmox_lxc/variables.tf b/opentofu/modules/proxmox_lxc/variables.tf
index 3ad79ef0..9426ab49 100644
--- a/opentofu/modules/proxmox_lxc/variables.tf
+++ b/opentofu/modules/proxmox_lxc/variables.tf
@@ -26,8 +26,9 @@ variable "unprivileged" {
}
variable "network_bridge" {
- type = string
- default = "v40srv"
+ description = "The network bridge to attach the container to"
+ type = string
+ default = "v40srv"
}
variable "ip_address" {